The present invention relates to a policy control technique using a policy to control a computer. In particular, the present invention relates to a technique which is effective to application to a policy control technique used to distinguish a fault occurrence place and a cause and take a measure when a fault or abnormality has occurred in a computer.
In recent years, a lot of business in enterprises is conducted on a computer system for business connected to a communication network. Availability and reliability are required of this business system. On the other hand, if a fault or abnormality has occurred in a business application or the business system or unexpected overload has occurred, then undertaking loss in customer business and lowered confidence of customers are caused by business suspension or business slowdown. In order to minimize these business losses, an administrator who operates the business system is required to clear up the cause fast and execute a suitable measure.
An example of operation under the present state will now be described. First, work for putting infinitely existing events in order is conducted. Events include:                an event issued by an operating system (OS);        an event in which operation management software is present;        an event issued by premise software (such as a database management system or Java) to operate a business application; and        an event issued by a business application.        
Version up in software typically increases event kinds and change contents.
Subsequently, an event issued upon a fault or abnormality is extracted from a manual or the like by manual work. And work of registering an action to be taken as a measure every event is conducted.
In not a few cases, however, there are a plurality of causes of fault or abnormality for a single event. It is difficult to distinguish an occurrence place and a cause of a fault or abnormality by using a single event. Therefore, it is possible only in a partial range to register actions for coping with an event, resulting in restricted operation.
In other words, when a fault or abnormality for which an action is not registered has occurred, measures cannot be taken, resulting in a problem.
If a fault or abnormality has occurred in a business system, a measure is executed in response to a message such as a fault notice sent from the business system at the present time. An example in which a measure is taken in response to a message is disclosed in, for example, JP-A-02-213948.
When executing a measure that corresponds to an event notice such as a notice of a fault and coping with the fault by utilizing the technique described in JP-A-02-213948, causes of the fault differ in some cases even if the fault notice event is the same. Causes of the fault differ in some cases according to the operation environment of the business application or the business system as well. In such a case, the only way of narrowing down fault causes in the conventional technique is to rely upon the experience and operation know-how of the administrator of the business system. Furthermore, each time business applications or fault causes increase, it is necessary to change registration of events and interpretation and decision of event contents. In addition, if a fault notice event is not given as a notice, it cannot be determined whether a fault has occurred. Even if an event notice is received, the issue origin of the event is not the fault occurrence place, in not a few cases. Therefore, it is considered substantially impossible for a person other than experts to distinguish the fault occurrence place and fault cause. Even if it is possible, a heavy burden is cast upon the user and much time and labor are needed.
A technique described in Japanese Patent No. 3291642 (corresponding to JP-A-08-314751) is a technique that makes it possible to display case data successively while giving priority to instance data having a higher frequency information value in retrieval history data. The CPU, phenomenon, cause, measure, and field (such as the product field) are used as retrieval keys.